CVE-2020-11868

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2020-11868
ntpd in ntp before 4.2.8p14 and 4.3.x before 4.3.100 allows an off-path attacker to block unauthenticated synchronization via a server mode packet with a spoofed source IP address, because transmissions are rescheduled even when a packet lacks a valid origin timestamp.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

5.0 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:N/AC:L/Au:N/C:N/I:N/A:P

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html Mailing List Third Party Advisory
http://support.ntp.org/bin/view/Main/NtpBug3592 Patch Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1716665 Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/05/msg00004.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202007-12 Third Party Advisory
https://security.netapp.com/advisory/ntap-20200424-0002/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html Mailing List Third Party Advisory
http://support.ntp.org/bin/view/Main/NtpBug3592 Patch Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1716665 Issue Tracking Third Party Advisory
https://lists.debian.org/debian-lts-announce/2020/05/msg00004.html Mailing List Third Party Advisory
https://security.gentoo.org/glsa/202007-12 Third Party Advisory
https://security.netapp.com/advisory/ntap-20200424-0002/ Third Party Advisory
https://www.oracle.com//security-alerts/cpujul2021.html Patch Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:*:*:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:-:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta2:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta3:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta4:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1-beta5:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1-rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p1-rc2:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p10:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p11:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p12:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p13:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p2:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc2:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p2-rc3:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p3:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc1:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc2:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p3-rc3:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p4:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p5:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p6:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p7:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p8:*:*:*:*:*:*
cpe:2.3:a:ntp:ntp:4.2.8:p9:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:a:netapp:data_ontap:-:*:*:*:*:7-mode:*:*
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:vsphere:*:*
cpe:2.3:a:netapp:virtual_storage_console:*:*:*:*:*:vsphere:*:*
cpe:2.3:o:netapp:clustered_data_ontap:-:*:*:*:*:*:*:*

Configuration 4 (hide)

AND
cpe:2.3:o:netapp:hci_storage_node_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:hci_storage_node:-:*:*:*:*:*:*:*

Configuration 5 (hide)

AND
cpe:2.3:o:netapp:fabric-attached_storage_8300_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:fabric-attached_storage_8300:-:*:*:*:*:*:*:*

Configuration 6 (hide)

AND
cpe:2.3:o:netapp:fabric-attached_storage_8700_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:fabric-attached_storage_8700:-:*:*:*:*:*:*:*

Configuration 7 (hide)

AND
cpe:2.3:o:netapp:fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:fabric-attached_storage_a400:-:*:*:*:*:*:*:*

Configuration 8 (hide)

AND
cpe:2.3:o:netapp:all_flash_fabric-attached_storage_8300_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:all_flash_fabric-attached_storage_8300:-:*:*:*:*:*:*:*

Configuration 9 (hide)

AND
cpe:2.3:o:netapp:all_flash_fabric-attached_storage_8700_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:all_flash_fabric-attached_storage_8700:-:*:*:*:*:*:*:*

Configuration 10 (hide)

AND
cpe:2.3:o:netapp:all_flash_fabric-attached_storage_a400_firmware:-:*:*:*:*:*:*:*
cpe:2.3:h:netapp:all_flash_fabric-attached_storage_a400:-:*:*:*:*:*:*:*

Configuration 11 (hide)

cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 12 (hide)

OR cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
History

21 Nov 2024, 04:58

Type Values Removed Values Added
References () http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html - Mailing List, Third Party Advisory () http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html - Mailing List, Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html - Mailing List, Third Party Advisory () http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html - Mailing List, Third Party Advisory
References () http://support.ntp.org/bin/view/Main/NtpBug3592 - Patch, Vendor Advisory () http://support.ntp.org/bin/view/Main/NtpBug3592 - Patch, Vendor Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=1716665 - Issue Tracking, Third Party Advisory () https://bugzilla.redhat.com/show_bug.cgi?id=1716665 - Issue Tracking, Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2020/05/msg00004.html - Mailing List, Third Party Advisory () https://lists.debian.org/debian-lts-announce/2020/05/msg00004.html - Mailing List, Third Party Advisory
References () https://security.gentoo.org/glsa/202007-12 - Third Party Advisory () https://security.gentoo.org/glsa/202007-12 - Third Party Advisory
References () https://security.netapp.com/advisory/ntap-20200424-0002/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20200424-0002/ - Third Party Advisory
References () https://www.oracle.com//security-alerts/cpujul2021.html - Patch, Third Party Advisory () https://www.oracle.com//security-alerts/cpujul2021.html - Patch, Third Party Advisory

26 Apr 2022, 17:05

Type Values Removed Values Added
CPE cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
CWE CWE-400 CWE-346
References
  • (N/A) https://www.oracle.com//security-alerts/cpujul2021.html - Patch, Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00005.html - Mailing List, Third Party Advisory
References (GENTOO) https://security.gentoo.org/glsa/202007-12 - (GENTOO) https://security.gentoo.org/glsa/202007-12 - Third Party Advisory
References (SUSE) http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html - (SUSE) http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00044.html - Mailing List, Third Party Advisory
Information

Published : 2020-04-17 04:15

Updated : 2024-11-21 04:58

NVD link : CVE-2020-11868

Mitre link : CVE-2020-11868

CVE.ORG link : CVE-2020-11868

JSON object : View

Products Affected

netapp

  • vasa_provider_for_clustered_data_ontap
  • fabric-attached_storage_8700
  • all_flash_fabric-attached_storage_a400_firmware
  • fabric-attached_storage_8300_firmware
  • all_flash_fabric-attached_storage_8700_firmware
  • hci_storage_node_firmware
  • fabric-attached_storage_8300
  • all_flash_fabric-attached_storage_8700
  • virtual_storage_console
  • solidfire
  • data_ontap
  • clustered_data_ontap
  • hci_management_node
  • fabric-attached_storage_a400
  • hci_storage_node
  • all_flash_fabric-attached_storage_8300
  • fabric-attached_storage_a400_firmware
  • fabric-attached_storage_8700_firmware
  • all_flash_fabric-attached_storage_8300_firmware
  • all_flash_fabric-attached_storage_a400

redhat

  • enterprise_linux

ntp

  • ntp

opensuse

  • leap

debian

  • debian_linux
CWE
CWE-346

Origin Validation Error